Medium severity · published Mar 23, 2018
CVE-2017-15326
DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker can exploit this vulnerability to crack the encrypted data and cause information leakage.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DT
Dbs3900 Tdd Lte Firmware · Huawei
v100r003c00; v100r004c10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15326
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180321-01-encryption-en
More from Dbs3900 Tdd Lte Firmware
7.5
CVE-2019-19414
There is an integer overflow vulnerability in LDAP server of some Huawei products
7.5
CVE-2019-19413
There is an integer overflow vulnerability in LDAP client of some Huawei products